PRIVACY NOTICE

Pursuant to the Federal Law of Protection of Personal Data Held in Private Possession (Ley Federal de Protección de Datos Personales en Posesión de Particulares) (the “Act”) and its Rules (the “Rules”) in force in Mexico, we hereby inform you the terms and conditions of Personal Data Privacy Notice (Aviso de Privacidad de Datos Personales) of Inmobiliaria Bahía de Conejos, S. de R.L. de C.V. (hereinafter referred to as the “HOTEL”) located in Blvd. Benito Juárez Lt. 8, Bahía de Conejos, C.P. 70989, Santa Cruz Huatulco, Oaxaca.

1. What information do we gather?

The HOTEL gathers your personal data by means of several formats. Some of these may request information related to yourself, such as: (i) Personal data, including name and surname, date of birth, private address, work address, phone number, e-mail address, tax identification number (Registro Federal de Contribuyentes) (“RFC”), Unique Population Registry Code (Clave Única de Registro de Población), and (ii) Financial or patrimonial information including credit card information in connection with payment of accommodation services. Such data hereinafter referred to as “Personal Data” (Datos Personales).

While checking-in the HOTEL, certain documentation (such as, copy of your photo identification, debit or credit card number and RFC) may be requested to you. We use the highest standards in terms of security in order to protect your Personal Data.

2. What do we use your information for?

The Personal Data we gather from you have the sole purpose of:

Primary Purpose: (a) Identifying the Guest, (b) Creating and updating our Guests’ records, including Guests’ information in connection with statistics related to their choices and preferences in accommodation services, and reviews provided by guests of the HOTEL; (c) Evaluating as potential client; (d) Providing required products and services, in a timely and proper manner, such as, reservations, purchase of vacation packages, purchase of memberships or any other vacation program and/or in connection with any other transaction related to accommodation, touristic and/or commercial services; (e) Informing you about similar services to those hired in past visit(s) to the HOTEL; (f) Carrying out studies and analysis related to consumer’s habits and behaviors; (g) Debit and credit card charges for purchased services; (h) Invoicing and billing, and; (i) Fulfilling our obligations with our guests in general.

Secondary Purpose: (a) Email advertising, (b) Informing about Hotel’s changes, gifts and/or special offers, (c) Evaluating the quality of the HOTEL’s services, and (d) Contacting directly to the guest by means of telephone or e-mail for the above mentioned purposes.

In collecting, processing and treating your Personal Data, we comply with the principles established by the Act; legality, quality, consent, information, finality, loyalty, proportionality and responsibility.

3. Who we share your Personal Data with?

The HOTEL may transfer your Personal Data exclusively to any of the AMResorts’ corporate group companies, as well as to any third party that has entered into a service agreement with the HOTEL in connection with, or in order to provide services for the benefit of the Guest, pursuant to item 2 of this Privacy Notice. In order to comply with the applicable law or any requirement from a competent authority, the HOTEL may reveal certain or allow the access to your Personal Data. We will not commercialize, sell or lease your personal information without your previous consent.

Your Personal Data may be compiled and storaged in a database exclusively owned by the HOTEL.

4. What security and control measures we use to protect your Personal Data?

The HOTEL has implemented administrative, technical and physical security measures in order to protect your Personal Data against damage, loss, alteration, destruction or unauthorized use or access to it, which we also demand from our service suppliers, even when those services are supplied or rendered by HOTEL’s subsidiaries or affiliates.

5. Who is in charge of the treatment of your Personal Data?

The “Committee of Personal Data” (Comité de Datos Personales) is in charge of processing and treating your Personal Data. The Committee of Personal Data opens from 9:00 to 18:00, Monday through Friday and is located in Blvd. Benito Juárez Lt. 8, Bahía de Conejos, C.P. 70989, Santa Cruz Huatulco, Oaxaca, direct phone number (+52) (958) 583-0501 or it can also be contacted to the e-mail address indicated in item 6 of this Privacy Notice.

6. How to exercise your ARCO rights and revoke consent to use your Personal Data?

Owners of Personal Data may exercise their ARCO rights (Access, Rectification, Cancellation and Opposition to processing and treating Personal Data), or revoke consent granted to the HOTEL for processing their Personal Data, by sending written petition to pdp.sechu@secretsresorts.com. Said request shall include, at least the following information: (a) name and address or any other contact information in order to notify you the response to your request; (b) documents proving your identity or legal representation, if applicable; (c) clear and precise description of the Personal Data for which you wish to exercise any of your ARCO rights, and (d) any other information tending to facilitate identifying your Personal Data.

7. When can you exercise your ARCO rights?

Pursuant to the Act and the Rules, you may request the exercise of your ARCO rights at any time; the HOTEL has the obligation to reply your request within the following 20 days. Once such period of time has elapsed and in case the HOTEL has not replied to your request, then you may file for the right’s protection procedure before the Federal Institute for Access to Public Information and Data Protection (Instituto Federal de Acceso a la Información y Protección de Datos) (IFAI).

8. Amendments to the Privacy Notice.

We may amend this Privacy Notice from time to time. Any amendment to this Privacy Notice will be informed to you by any of the following means: (i) visible signs placed in the HOTEL’s facilities (bulletin board), (ii) HOTEL’s website, or (iii) email or mail directly to the provided addresses. We will not be held responsible if you do not learn of any amendment to this Privacy Notice or in case you do not receive that certain communication distributed by the HOTEL. For your convenience, please check over the content of this Privacy Notice periodically by sending a request to our email address pdp.sechu@secretsresorts.com.

9. Other applicable regulations.

The HOTEL is located in Mexico and Mexican law regulates all the matters related to the Personal Data. By providing your information to the HOTEL, you consent us to use and transfer your Personal Data as mentioned above, and accept this Privacy Notice.

This Privacy Notice complies with the requirements established by the Act and the Rules.